Feds Charge Alleged New York Cell In International Cyber Heist

Cybercriminals allegedly hacked into databases for prepaid debit cards and used the compromised data to steal from ATMs around the world.

Damien MeyerAFP/Getty Images

Originally published on May 9, 2013 4:39 pm

Eight people in New York have been charged as part of what prosecutors say was a global ring of cybercriminals who stole $45 million by hacking into prepaid credit card accounts and then using the data to get cash from thousands of ATMs around the world.

U.S. Attorney for the Eastern District of New York Loretta Lynch described the alleged scheme as "a massive 21st century bank heist that reached across the Internet and stretched around the globe. In the place of guns and masks, this cybercrime organization used laptops and the Internet."

Prosecutors say the eight suspects being charged, one of whom is now dead, were the New York cell of the operation that involved people in 26 countries.

"The gang first struck December 22 when hackers targeted a credit card processor that handled transactions for prepaid MasterCard debit cards issued to customers of the National Bank of Ras Al-Khaimah PSC, or RAKBANK, in the United Arab Emirates. They handed off the stolen card data to cashers in 20 countries who withdrew $5 million in cash in more than 4,500 ATM withdrawals.

"The eight charged in New York ... were responsible for allegedly siphoning at least $2.8 million from more than 750 Manhattan ATMs in 2.5 hours.

"The second round of the operation struck on February 19, beginning around 3pm and continuing until 1:30 the next morning. It targeted another bank card processor that handled transactions for the Bank of Muscat in Oman. Within 10 hours, cashers in 24 countries had made about 36,000 ATM withdrawals totaling about $40 million."

"The crooks weren't shy about using the stolen funds either. On one day, the US crooks strolled into a bank branch in Miami, Florida, to deposit $150,000 in the form of 7,491 $20 bills into an account controlled by defendant Alberto Yusi Lajud-Peña.

"The defendants face a maximum sentence of 10 years' imprisonment on each of the money laundering charges and 7.5 years on the conspiracy to commit access device fraud charge, and up to $250,000 in fines."

The Associated Press quotes federal prosecutors as saying arrests of ring members began in March and that law enforcement agencies in Japan, Canada, Germany, Romania and 12 other countries have been involved in the investigation.